Architecture

How It Works

Strict, localized analysis of extension capabilities. Designed for zero-trust environments.

1. Manifest Retrieval

When initialized, the extension queries the chrome.management API to fetch metadata for all installed extensions. This occurs in a restricted local scope.

const extensions = await chrome.management.getAll();

2. Permission Analysis

The raw permission strings are run against our proprietary risk matrix. We evaluate both explicit permissions (e.g., cookies) and host patterns (e.g., *://*/*).

High Impact

debugger

webRequest

Medium Impact

tabs

storage

3. Scoring & Visualization

A normalized risk score (0-100) is calculated and visualized for the user. Higher scores indicate broader attack surface potential.